diff --git a/README.md b/README.md
index 4fdf250..f226bb8 100644
--- a/README.md
+++ b/README.md
@@ -9,6 +9,7 @@
 * 📦 Installs essential system packages
 * 📊 Sets up Prometheus Node Exporter (v1.8.2)
 * 🔍 Configures system health monitoring daemon (hwmon)
+* 🔑 Raises the kernel keyring quota on PVE nodes (`/etc/sysctl.d/99-keyrings.conf`) so Docker in unprivileged LXC, like the Gitea CI runner, can keep starting containers
 * ✅ Performs initial dry-run test of monitoring systems
 
 ## 📋 Prerequisites
diff --git a/freshStart.sh b/freshStart.sh
index 0cfb594..811e906 100644
--- a/freshStart.sh
+++ b/freshStart.sh
@@ -64,6 +64,30 @@ else
     apt-get install -y $COMMON_PKGS nvme-cli
 fi
 
+# =============================================================================
+# Kernel keyring quota (PVE only)
+# =============================================================================
+# Root inside every unprivileged LXC maps to one host user (uid 100000), so all
+# containers on a node share a single kernel keyring quota. Docker (the Gitea
+# runner, CT 119) takes an entry for every container it starts and exhausts the
+# 20 KB default, which breaks CI with "unable to create session key: disk quota
+# exceeded". HA can move containers to any node, so every PVE node gets this.
+if [[ "$PLATFORM" == "pve" ]]; then
+    echo "Raising kernel keyring quota for unprivileged containers..."
+    cat > /etc/sysctl.d/99-keyrings.conf << 'EOF'
+# LotusGuild: raise the per-user kernel keyring quota.
+# Root inside every unprivileged LXC maps to one host user (uid 100000), so all
+# containers on a node share one keyring quota. Docker (Gitea runner, CT 119)
+# takes an entry per container it starts and exhausts the 20 KB default, which
+# breaks CI with "unable to create session key: disk quota exceeded".
+# Managed by LotusGuild/freshStartScript.
+kernel.keys.maxkeys = 20000
+kernel.keys.maxbytes = 2000000
+EOF
+    sysctl -q --load /etc/sysctl.d/99-keyrings.conf ||
+        echo "WARNING: could not apply keyring limits now; they take effect at next boot"
+fi
+
 # Install Node Exporter
 echo "Installing Prometheus Node Exporter..."
 NODE_EXPORTER_VERSION="1.8.2"